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ABSTRACT 


The potential for cascade failure of the U.S. crude oil pipeline infrastructure is analyzed 
using Model Based Risk Assessment software. The pipeline system that distributes crude 
oil to refineries across the United States has gained much media attention with President 
Obama’s denial of a permit to complete a key portion the Keystone-XL pipeline that will 
carry oil from Alberta, Canada to the Cushing Oil Trading Hub (COTH) in Cushing, OK. 
The analysis identified the COTH as the primary critical hub. The COTH is one of the 
world’s major oil terminals. A disruption of the COTH, Midwest/West Coast oil 
distribution networks, or critical hubs would have far-reaching negative consequences 
affecting global trade. The analysis also identified regional differences in network 
resiliency and susceptibility to cascade failure. Protecting all 55,000 miles of the U.S. 
crude oil pipeline infrastructure from catastrophic failure is an unachievable goal, but 
protection of the network from cascade failure and a Black Swan event can be achieved 
by protecting network hubs. The results of this analysis should be used as a starting point 
to increase network resiliency and prioritize the use of resources to secure the crude oil 
pipeline network against cascade failure. 
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I. 


INTRODUCTION 


The United States has an overwhelming dependency on crude oil and is the 
largest consumer of crude oil in the world. It leads the world in oil consumption, and 
consumes approximately 19 million barrels of crude oil per day, or two-thirds more than 
that of the European Union and double the consumption of China, which are second and 
third in world oil consumption, respectively. 1 For the United States to move such a large 
volume of oil across the country, a massive pipeline network was developed that began in 
the 19th century. The purpose of this project was to assess the nation’s crude oil pipeline 
network and identify the hubs that would have the greatest impact if their operation were 
disrupted by a terrorist attack, natural disaster, or other catastrophic event. 

Crude oil pipeline infrastructure is critical to the North American energy supply 
chain that has evolved substantially over the past century. The U.S. economy relies 
almost completely on crude oil pipelines as critical infrastructure for enabling business, 
transportation, heating and energy production, petrochemical production, raw materials 
for manufacturing, lubrication products, and hundreds of other uses critical to the 
American way of life. Without the daily delivery of crude oil to U.S. refineries via the 
vast and complex network of crude oil pipelines, the U.S. economy would rapidly decline 
and become unsustainable. 

Prior to the passage of pipeline safety legislation in 2002, pipeline safety and 
security were not considered a priority by government regulators. 2 In 1968, 3 Congress 
created the main regulatory body, the Office of Pipeline Safety (OPS) within the 
Department of Transportation (DOT) to conduct a “national program to ensure the safe, 
reliable and environmentally sound operation of the Nation's pipeline transportation 


1 “CIA-The World Factbook,” (n.d.), https://www.cia.gov/library/publications/the-woiid- 
factbook/rankorder/217 4rank.html. 

2 Carol Parker, “The Pipeline Industry Meets Grief Unimaginable: Congress Reacts with the Pipeline 
Safety Improvement Act of 2002,” Natural Resources Journal 44, no. 1 (2004): 244—282. 

3 Ibid. 
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system.” 4 In 1978, the General Accounting Office (GAO) reported that OPS had weak 
enforcement, maintained inaccurate records, and administered ineffective rules. In 2000, 
the GAO again reemphasized its 1978 findings that criticized the OPS for its 
unwillingness to work with states to improve pipeline safety and its weak enforcement of 
safety rules. 5 As of 2001, OPS did not maintain an accurate map of the pipelines it 
regulated. Additionally, OPS had the lowest implementation rate of National 
Transportation Safety Board (NTSB) recommendations of any agency in DOT. The 
NTSB, DOT Inspector General, American Petroleum Institute and both houses of 
Congress were critical of OPS’s poor history of accident data collection, regulation, and 
enforcement of existing regulations. 6 

In a review of 319 pipeline safety related journal articles from 1971-2000 that 
identified trends by frequency of keyword content analysis methodology, Larranaga and 
Sandoval found an exponential growth rate in keyword frequency or pipeline safety 
related terms per time period in the published literature. The number of journal articles 
published from 1971-2000 grew exponentially per time period, which indicated an 
increasing awareness of pipeline safety issues in the scientific community. See Figure 1. 
During these same time periods, the frequency of use of the term “legislative/regulation” 
increased 237%, the keyword “accidents” increased 244%, and the term “safety 
management” increased 408%. 7 Despite the increased awareness of safety related issues 
in the scholarly literature, it took several catalyzing incidents from 1999-2001 to 
generate the impetus for new pipeline safety legislation. 


4 DOT-PHMSA, “PHMSA—Organization—Office of Pipeline Safety,” (n.d.), 
http://www.phmsa.dot.gov/portal/site/PHMSA/menuitem.ebdc7a8a7e39f2e55cf2031050248a0c/7vgnextoid 
=ca9fe4fca038011 OVgn VCM100000762c7798RCRD&vgnextchannel=8938143389d8c01 OVgnVCM 1000 
008049a8c0RCRD&vgnextfmt=print. 

5 Parker, “The Pipeline Industry Meets Grief Unimaginable: Congress Reacts with the Pipeline Safety 
Improvement Act of 2002.” 

6 Ibid. 

7 Michael D. Larranaga, and Angela Sandoval, “Current Safety Issues Associated with Natural Gas 
Transportation and Distribution,” presented at the X Congreso y Exposicion Iberoamericana de 
Tecnologlas en Prevencion de Incendio, Proteccion Ambiental y Seguridad Industrial SEGUR-Fire 2001, 
Caracas, Venezuela, July 2001. 
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Figure 1. Pipeline Safety Related Journal Publications per Time Period 


These major incidents led to President Bush to sign the new Pipeline Safety 
Improvement Act of 2002, which capped years of effort to strengthen pipeline safety laws 
by the NTSB, state agencies, and others, including victims of pipeline accidents that 
included the following. 8 

• 1999, Bellingham, Washington—approximately 250,000 gallons of 
gasoline spilled from a ruptured pipeline/explosion. Three children were 
killed and a fireball 1.5 miles long was sent through a city of 
approximately 70,000 people. The explosion created a mushroom cloud 6 
miles high and damage claims exceeded half a billion dollars. 

• 2000 Carlsbad, New Mexico—An El Paso Energy natural gas pipeline 
explosion killed 12 campers from a single family. This incident 
contributed significantly to the California energy crisis of 2001. The 
governor of New Mexico referred to the scene as “grief unimaginable.” 


8 Parker, “The Pipeline Industry Meets Grief Unimaginable: Congress Reacts with the Pipeline Safety 
Improvement Act of 2002.” 
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• 2000 Dallas, Texas—The rupture of a gasoline pipeline resulted in a 
contaminated water supply, which led to $2.75/gallon gasoline and lower 
air quality in Chicago and Milwaukee. 

• 2000, Michigan—A gasoline pipeline rupture caused more than 1,200 
people to evacuate their residences, and some for more than 3 months. 

• 2000, Maryland—A fuel oil pipeline rupture contaminated miles of the 
Patuxent River, which resulted in clean up costs of $71 million. 

An additional 227 pipeline failures occurred in the year 2000 that caused a record 
$197 million in property damage and the highest number of fatalities in 25 years. Two 
catastrophic events associated with security and pipelines were the venerable “straw that 
broke the camels back” and catalyzed change in pipeline safety legislation. The first was 
the September 11, 2001 terrorist attacks, and the second, just one month later, was a lone 
gunman who fired a rifle at the Trans-Alaska pipeline and created a leak that shut down 
one-fifth of domestic oil production. 9 Both these security incidents highlighted the 
vulnerability of pipelines to security breaches. Although the pipeline safety and security 
bill was introduced in the House as the “Pipeline Infrastructure Protection to Enhance 
Security and Safety Act,” political considerations removed all sections expressly 
addressing security, which resulted in the final bill being the “Pipeline Safety 
Improvement Act of 2002.” 10 

Following the September 11, 2001 terrorist attacks, the Department of Homeland 
Security (DHS) was created by integrating 22 existing departments within the federal 
government. One of these departments, the Transportation Safety Administration (TSA), 
was given the responsibility of overseeing the country’s pipeline security. TSA has built 
on OPS’s previous security recommendations to operators, and both agencies are now 
working together to ensure the nation’s pipelines are both safe and secure. 11 


9 Parker, “The Pipeline Industry Meets Grief Unimaginable: Congress Reacts with the Pipeline Safety 
Improvement Act of 2002.” 

10 Ibid. 

11 U.S. Library of Congress, Congressional Research Service, America’s Pipelines Safe and Secure: 
Key Issues for Congress, by Paul W. Parfomak, CRS Report R41536 (Washington, DC: Office of 
Congressional Information and Publishing, March 13, 2012). 
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With these improvements to pipeline security over the last decade, the U.S. 
pipeline network should be more secure than ever. With the increased recognition of the 
pipeline network as a critical infrastructure, it is important to utilize protection resources 
wisely and in the most effective manner possible. This analysis seeks to provide insight 
on where resources can be most useful to optimize protection. 


5 
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II. BACKGROUND 


With the 1860 oil boom in Pennsylvania fueling the world’s appetite for oil, a 
need developed for an efficient way to transport large volumes of oil to refineries. Early 
transportation methods relied on horse drawn carts to move oil filled whiskey barrels 
from the production fields to river barges and trains that then took the oil to refineries. 12 
This method quickly became impractical, and in 1865, a man named Van Syckel replaced 
the whiskey barrels with the world’s first oil pipeline. Syckel’s pipeline was six inches in 
diameter, constructed of wood, and relied on gravity to move its 80 barrel per hour 
capacity five miles. 13 His idea spread, and small pipelines, known as gathering lines, 
quickly became the main means of transporting crude over short distances. While this 
reduced the time needed to move the crude oil to refineries, transportation over long 
distances was still reliant on trains. 14 

In 1878, the first large pipeline, or trunk line, was built by the Tidewater Oil 
Company. This pipeline was constructed in secret to avoid interference by the powerful 
Standard Oil Company. The six-inch iron pipe stretched 109 miles over mountainous 
terrain and required an 80 horsepower pump to push the crude at a rate of 250 barrels per 
hour. 15 Soon, the number of trunk lines connecting oil fields to refineries grew, which 
made crude oil transportation even more efficient. 

The crude oil pipeline infrastructure continued to grow over the next several 
decades with the use of larger pipes and improved technology. With the U.S. involvement 
in World War II, a need was recognized to distribute oil across the nation more 
effectively. As a result, the War Department established the Petroleum Administration for 


12 BP, “BP Pipelines—Our History,” (n.d.), http://www.bppipelines.coni/history.html. 

13 BP, “BP Pipelines—Our History”; Phil Hopkins, “Oil and Gas Pipelines: Yesterday and Today,” 
2007, www.penspen.com/Downloads/Papers/.../OilandGasPipelines.pdf. 

14 Samuel T. Pees, “Oil History,” 2004, 
http://www.petroleumhistory.org/OilHistory/pages/Pipelines/BigYear.html. 

15 Ida Minerva, The History of the Standard Oil Company: 2 Volumes in 1 (The MacMillan Company, 
1904); Floyd L. Hartman, “1879: Tidewater Pipe Company—World’s 1st Successful Oil Pipeline,” 2009, 
www.smethporthistory.org/coryville/tidewatermap.html. 
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Defense. This administration created five Petroleum Administration for Defense Districts 
(PADDs) across the United States. Each PADD oversaw the refining and distribution of 
oil within its own district as shown in Figure 2. 16 Although the PADDs were created 
during WWII when gasoline was rationed, they are used today for supply monitoring. 17 
After Nazi submarines became more active in the Atlantic Ocean and sunk several 
merchant-marine tankers threatening the east coast’s oil supply, new crude oil pipelines 
were constructed to make the PADDs more interconnected and less vulnerable to 
catastrophic interruption of service. 18 This led to an increased reliance on pipelines for 
the delivery of crude oil. 


Petroleum Administration 
for Defense Districts 

padd 4: 

Rockies 

PADD 5: A [ im p„ 

VVesf Coast, i ] L , 

AK, HI 

PADD 1: 

N 7 East Coast 


PADD 3: Gulf Coast 


Figure 2. Petroleum Administration Defense Districts. 19 


lf) National Archives, “Records of the Petroleum Administration for Defense,” 1950; Oil Infrastructure 
Subgroup, “Crude Oil Infrastructure,” NPC North American Resource Development Study, September 15, 
2011, 

http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=l&ved=0CCYQFjAA&uii=http%3 
A%2F%2Fwww.npc.org%2FPrudent_Development-Topic_Papers%2Fl- 

7_Crude_Oil_Infrastructure_Paper.pdf&ei=q2wxT8enGZTHsQL17IjwBg&usg=AFQjCNEj8mFdkYOysIn 
CPfGzfpveD VE W zg. 

17 Theodore Lewis, Critical Infrastructure Protection in Homeland Security: Defending a Networked 
Nation (Hoboken, NJ: John Wiley & Sons, 2006), 296. 

18 National Archives, “Records of the Petroleum Administration for Defense.” 

19 Oil Infrastructure Subgroup, “Crude Oil Infrastructure.” 
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Since WWII, the U.S. crude oil pipeline network has continued to grow and 
become even more interconnected. It now stretches over 55,000 miles and transports 
millions of barrels of crude oil per day. 20 This large network supports both the U.S. 
economy and military, which makes it one of the nation’s most valuable critical 
infrastructure components. 

A. LITERATURE REVIEW 

The United States consumes approximately 19-20 million barrels per day (bpd) of 
petroleum products. 21 A complex web of pipeline infrastructure and water transport 
routes moves crude oil from where it is extracted from the earth (oil fields, oil basins, 
offshore oil fields, and oil seaports via importation) to where it is processed and refined 
for delivery to the marketplace in a variety of forms: gasoline, diesel, heating oil, aviation 
fuel, lubricants, and raw materials for the development of a variety of other products that 
this nation uses every day. These other materials include plastics, light bulbs, shoes, 
medical equipment, rubber, construction materials, and a variety of other products. 22 

Crude oil pipeline infrastructure is critical to the North American energy supply 
chain that has developed over the past century. 23 The U.S. economy relies almost 
completely on crude oil pipelines as critical infrastructure for enabling business, 
transportation, heating and energy production, petrochemical production, raw materials 
for manufacturing, lubrication products, and hundreds of other uses critical to the 
American way of life. Without crude oil being delivered on a daily basis to refineries 
across the United States via the vast complex network of crude pipelines, the U.S. 
economy would fail, and the return to the use of horse-drawn carriages as a major mode 
of transportation would be incontrovertible. 24 Crude oil is delivered to a complex 

20 Oil Infrastructure Subgroup, “Crude Oil Infrastructure.'’ 

21 “CIA-The World Factbook”; Neal Adams, Terrorism & Oil (Tulsa, OK PennWell Corp., 2003), 32; 
Cheryl I. Trench, “How Pipelines Make the Oil Market Work—Their Networks, Operation and 
Regulation,” December 2001, 1, http://www.pipelinel01.com/Overview/cmde-pl.html. 

22 Adams, Terrorism & Oil, 2-3. 

23 Oil Infrastructure Subgroup, “Crude Oil Infrastructure,” 4. 

24 Adams, Terrorism & Oil, 1. 
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network of refineries across the United States, whereby the crude oil is processed and 
refined into finished products, such as gasoline, kerosene, aviation fuel, and other 
chemicals for delivery to market. Crude oil itself falls under the Energy Critical 
Infrastructure Sector (ECIS) as defined by the U.S. Department of Homeland Security 
(DHS), while the crude oil pipeline infrastructure falls under both the ECIS and the 
Transportation Critical Infrastructure Sector (TCIS). 25 Without a stable ECIS, the health 
and welfare is threatened and the U.S. economy cannot function. 26 Figure 3 shows the 
interdependencies of the 18 Critical Infrastructure Sectors (CIS) and the criticality of the 
ECIS to all other sectors. 



Figure 3. Dependence Diagram (Connecting Lines Indicate Sector Dependence on 
Each Other) of U.S. Department of Homeland Security Critical 
Infrastructure Sectors. 27 Adapted from Lewis, 2006. 28 


Department of Homeland Security, “DHS Critical Infrastructure,” (n.d.), 
http://www.dhs.gov/files/programs/gc_1189168948944.shtm. 

26 DHS, “DHS-Energy Sector: Critical Infrastructure,” (n.d.), 
http://www.dhs.gov/files/programs/gc_l 189013411585. shtm. 

27 Department of Homeland Security, “DHS Critical Infrastructure.” 

28 Lewis, Critical Infrastructure Protection in Homeland Security: Defending a Networked Nation , 57. 
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The price of crude oil is set based on the market clearing location for the COTH 
in the heart of the midcontinent region of the United States. The U.S. crude pipeline 
infrastructure is divided into PADDs. Most crude in PADDs II, III, and IV, and the fuel 
imported from Western Canada, travels through the COTH for redistribution via the vast 
pipeline network to refineries in PADDS II, III, and IV. 29 For most of the 20th century, 
Tulsa, Oklahoma was known as the “Oil Capitol of the World” and developed in to one 
of the most important hubs in the oil industry. A major oil gusher at Glenpool, 15 miles 
south of Tulsa, was discovered in 1905, which prompted a rush of entrepreneurs to the 
area. 30 The Glenpool basin was owned in large part by Henry Ford Sinclair and became 
central to the formation of the Sinclair Oil Company in 1916. In 1907, Oklahoma became 
the nation’s largest oil producer. 31 Major oil basins at Cushing were subsequently 
discovered in 1912 and Cushing became a center for exploration and production of 
nearby oil fields. By 1914, the Cushing field was producing 50,000 barrels per day, or 
one-quarter of the entire state’s production. 32 In 1928, the Oklahoma City Field was 
discovered and soon became the nation’s largest oil producing basin. From 1916-1929, 
several major oil and oil service entities were founded in Oklahoma, including Sinclair 
Oil, Marland Oil (merged with Conoco in 1929), Cities Services Oil Company (now 
CITGO), Champlin Petroleum Co. (now Champlin Refining Company), Phillips 
Petroleum Co., American Association of Petroleum Geologists, Halliburton, Noble 
Corporation, Anderson & Kerr Drilling (Kerr-McGee, purchased by Anadarko Petroleum 
in 2005) and others. 33 At least two refineries operated in Cushing. As nearby oil fields 
began to run dry in the 1940s, production became less important and the maze of 


29 Oil Infrastructure Subgroup, “Crude Oil Infrastructure,” 5. 

30 Wikipedia, the Free Encyclopedia, “Tulsa, Oklahoma,” (n.d.), 
http://en.wikipedia.org/wiki/Tulsa,_Oklahoma. 

31 Dan Boyd. “Milestones in the Oklahoma Oil and Gas Industry,” Oklahoma Geological Survey, 
(n.d.), http://www.ogs.ou.edu/oilgasmilestones.php. 

32 Ibid. 

33 Ibid. 
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pipelines and storage tanks that had been built to service the Cushing refineries began to 
transport crude to Cushing and other refining markets. 34 

The COTH first developed as an oil-trading center and then became the official 
price settlement point for the West Texas Intermediate (WTI) crude, the benchmark 
against which most types of North American Crude are priced. The COTH is now best 
known as a bottleneck for the energy industry. 35 For the past four decades, the COTH has 
supplied crude oil from Gulf Coast imports and domestic Mid-Continent areas to 
Midwest refining markets. 36 As such, the crude pipeline system evolved from the pre- 
WWII era of mostly distributing domestic supply from the Mid-Continent areas to 
refining markets to moving both domestic supplies and Gulf Coast imports to the interior 
of the country, mostly through Cushing, where crude could be redistributed to refineries 
across the Midwest. As supplies from domestic sources declined, the crude oil pipeline 
system was reversed to deliver crude oil produced in Alberta, Canada to the COTH where 
Canadian crude could be distributed to both Midwest and Gulf Coast refining markets. 37 
More recently, other crude pipelines reversed flow direction due to increasing domestic 
supplies from shale reserves in North Dakota and Texas, which brings additional crude 
supplies through the COTH. 38 

U.S. refining capacity is highly concentrated along the Gulf Coast between 
Galveston, Texas and Baton, Rouge, Louisiana. Many petroleum companies have moved 
either corporate or operations capability to Houston, Texas because of the highly 
centralized oil activity along the Gulf Coast. The largest two refineries in the United 
States (Baytown, Texas and Baton Rouge, Louisiana) produce 5% of the national refined 


34 Wikipedia, the Free Encyclopedia, “Cushing, Oklahoma, (n.d.), 
http://en.wikipedia.org/wiki/Cushing,_Oklahoma. 

35 Matthew Phillips, “Unlocking the Crude Oil Bottleneck at Cushing,” Business Week , May 16, 2012, 
http://www.businessweek.eom/articles/2012-05-16/unlocking-the-crude-oil-bottleneck-at-cushing#pl. 

36 Institute for Energy Research, “The Booming Sooners: Vast Energy, Low Prices, Low 
Unemployment,” July 11, 2012, http://www.instituteforenergyresearch.org/2012/07/ll/those-booming- 
sooners-plentiful-energy-low-energy-prices-low-unemployment/. 

37 Ibid.: Phillips, “Unlocking the Crude Oil Bottleneck at Cushing.” 

38 Institute for Energy Research, “The Booming Sooners: Vast Energy, Low Prices, Low 
Unemployment”; Phillips, “Unlocking the Crude Oil Bottleneck at Cushing.” 
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products supply and the top 10 refineries produce 20% of the total. One hundred fifty-two 
refineries are located in 32 states, and are mostly concentrated in PADDs II, III, and IV. 
The vulnerability and critical nature of the refining network was highlighted in 2005 
when Hurricane Katrina slammed the Gulf Coast and interrupted the nation’s energy 
supply chain, which resulted in increased fuel prices nationwide. 39 

Five of the top 10 producing refineries are located in the Gulf Coast geographic 
cluster and produce 11% of the total U.S. supply. 40 Over the past decade, the United 
States has trended away from its reliance on waterborne imports, and moved towards 
imports from Western Canada via crude pipeline. Since 1987, imports of Canadian crude 
oil have tripled to approximately 2.5 million barrels per day with most of the increase 
occurring during the past decade. 41 This shift has resulted in significant changes in the 
Midwest and Rocky Mountain regions. Many of the pipeline networks in these regions 
were established to supply domestically produced light crude from Texas and the Gulf 
Coast region to large refining hubs in PADD II. Northbound crude flow from Cushing, 
Oklahoma and St. James, Louisiana were once the backbone of the crude oil pipeline 
infrastructure for the Mid-Continent, Gulf Coast, and Midwest regions. Today, they form 
redundancy as flow is reversed and Canadian crude is distributed southbound through 
Cushing and down to Texas and the Gulf Coast. 42 

The Rocky Mountain region faces the same situation whereby a surplus of light 
Rocky Mountain crude supply exists, coupled with increasing availability of Canadian 
crude that resulted in lower takeaway pipeline capacity for Rocky Mountain crude. The 
growth of alternative crude supplies in PADD II and increasing Canadian production and 
crude imports is causing an imbalance in the traditional crude market dynamics in the 
Gulf Coast region. 43 


39 Lewis, Critical Infrastructure Protection in Homeland Security: Defending a Networked Nation, 
297-298. 

40 Ibid. 


41 Oil Infrastructure Subgroup, “Crude Oil Infrastructure,” 7. 

42 Ibid. 

43 Ibid. 
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Both the East Coast (PADD I) and the West Coast (PADD V) remain largely 
independent markets from the remaining PADDs yet face unique challenges. California 
has no intra- or inter-regional pipeline infrastructure, and the California Energy 
Commission has forecasted the need for expansive modifications to waterborne import 
facilities and tankage by 2030 to accommodate the state’s increasing crude demands and 
the replacement of existing import facilities already past their useful lives. 44 The East 
Coast region faces similar challenges. 

Despite the changes in market dynamics, PADD II, specifically the COTH, 
remains the nexus of the North American crude supply, maintains the most critical crude 
pipeline infrastructure, and distributes the vast majority of the U.S. crude supply on a 
daily basis. The COTH stores 5-11% of the total national crude inventory and serves as 
the price settlement point for the benchmark WTI on the NYMEX. 45 The COTH 
distributes approximately 14 million barrels per day and services several major pipeline 
corridors for the receipt of oil from U.S. oil basins or foreign imports for distribution to 
refineries, where the oil is then processed into other products and shipped to market. The 
COTH receives imported Canadian crude via the Keystone pipeline (590K bpd) for 
distribution to refineries. The proposed Keystone-XL pipeline that runs from Canada to 
the COTH and on down to Port Arthur, Texas would increase the capacity of the 
Keystone Pipeline System (Keystone + Keystone-XL) to 1.3 million bpd and serve to 
increase the amount of crude imported from Canada. The Keystone-XL pipeline will 
connect the COTH to receive Canadian oil and continue through Oklahoma to terminals 
in Nederland, Texas to serve the Port Arthur, Texas refining facilities. 46 The estimated 
completion date for the Keystone-XL pipeline is unknown at this time due to President 
Obama’s denial of the permit for the construction of the pipeline that will transport crude 
from Alberta, Canada to Steele City, Kansas and then down to the COTH 47 The existing 

44 Oil Infrastructure Subgroup, “Crude Oil Infrastructure,” 7. 

46 Ibid.. 8; Brett Clanton, “Oklahoma Oil Hub Helps Keep Oil Prices from Going Higher,” Houston 
Chronicle, March 3, 2011, http://www.chron.com/business/energy/article/Oklahoma-oil-hub-helps-keep- 
oil-prices-from-going-1550679.php. 

46 TransCanada, “Keystone Pipeline Project,” (n.d.), http://www.transcanada.com/keystone.html. 

47 “Statement by the President on the Keystone XL Pipeline I The White House,” (n.d.), 
http://www.whitehouse.gov/the-press-office/2012/01/18/statement-president-keystone-xl-pipeline. 
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Keystone Pipeline, Keystone Cushing Expansion Pipeline, and the proposed route of the 
Keystone-XL Pipeline are shown in Figure 4. 
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Figure 4. The proposed Keystone-XF Pipeline Route. The Keystone Cushing 
Expansion Extended the Keystone Pipeline System from Steele City, 
Kansas to the COTH. Adapted from TransCanada. 48 


48 TransCanada, “Keystone Pipeline Project.” 
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The COTH is one of the largest crude storage facilities in the world and the 
largest transportation facility on the continent. It is one of the world’s major oil terminals, 
distributing more than 70% of the nation’s crude oil on a daily basis. 49 The COTH has 
virtually no competition, and a significant disruption on the COTH would be catastrophic 
on a global scale. 50 The COTH is unprotected from attack and former CIA director James 
Woolsley described the facility as not hardened and an easy target. 51 In addition, the 
COTH has already been identified as a major pipeline hub and the hubs are the main 
source of vulnerability to the U.S. pipeline systems. 52 

The COTH is particularly vulnerable to a catastrophic interruption in service due 
to severe weather (e.g., Oklahoma’s frequent ice storms, floods, and tornados) and/or a 
terrorist attack. A successful appropriately timed terrorist attack in the midst of a severe 
weather related event would result in widespread negative political, psychological, and 
economic impacts on the national level. 53 The large diameter pipelines coming into and 
leaving the COTH present the greatest vulnerability, as the large diameter pipes transport 
as much as 30-40 times more crude than smaller pipelines, but at the same time, reduce 
the number of required pipelines. 54 The hundreds of storage tanks at the COTH present 
the next largest vulnerability. An extreme event (weather event or terrorist attack) could 
significantly disrupt or destroy the COTH. It is a critical infrastructure vulnerable to 
attack and disruption that today receives less than adequate security consideration by 
industry and government. 55 

The COTH presents an optimal target for terrorists. In March 2011, the Houston 
Chronicle reported that the COTH stored 11% of the nation’s inventory, which is double 

49 Wikipedia, the Free Encyclopedia, “Cushing, Oklahoma.” 

50 Adams, Terrorism & Oil, 108; Anthony L. Kimery, “US Oil Complex Vulnerable to Attack,” 
Homeland Security Today, November 27, 2007, http://www.hstoday.us/blogs/the-kimery-report/blog/us- 
Oil-complex-vulnerable-to-attack/76d4b30a2b40c0a76d0fae629a06c50a.html. 

51 Kimery, “US Oil Complex Vulnerable to Attack.,” 

52 Lewis, Critical Infrastructure Protection in Homeland Security: Defending a Networked Nation, 

295. 

53 Adams, Terrorism & Oil, 107-108. 

54 Ibid.. 107. 

55 Kimery, “US Oil Complex Vulnerable to Attack.” 
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its capacity of only a few years ago and was expected to continue increasing storage 
capacity in the years to come. Enbridge, owner of a 1,000-acre tank farm at the COTH, 
maintains that the COTH’s future as a major oil hub was promising and both Enbridge 
and other COTH owners were committed to the expansion of the COTH long into the 
future. 56 

A single large bomb the size of that used in the Oklahoma City bombing could 
destroy the COTH complex’s ability to operate if placed appropriately. Multiple small 
bombs or insider sabotage could have similar effects. Additionally, an attack against the 
COTH storage tank farms could be catastrophic from an environmental and economic 
standpoint, as Cushing could no longer moderate the supply and demand and hence, 
pricing, for the U.S. oil industry. A tornado similar to the Moore, Oklahoma (1999) or the 
Joplin, Missouri (2011) tornadoes would be similarly catastrophic. A vulnerability 
assessment conducted by U.S. Department of Homeland Security Science, Technology, 
Engineering, and Math Scholars at Oklahoma State University found that the COTH was 
most vulnerable from an assault to the site, as well as oil storage tanks, pipelines, 
pumping stations, the control center, and utilities. The study found that a medium risk 
was associated with a small aircraft assault on the COTH, as the Cushing Municipal 
Airport is located immediately adjacent to the COTH. In addition, the study found 
multiple readily accessible entry methods. 57 See Figure 5. 


56 Clanton, “Oklahoma Oil Hub Helps Keep Oil Prices from Going Higher.” 

57 Donald Furgeson, John Mahoney, and Brett Warfield, Security Vulnerability Assessment of the 
Cushing Oil Storage Facility (Stillwater, OK: Oklahoma State University, November 30, 2011). 
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Figure 5. Vulnerability Assessment Matrix of the COTH. 58 


58 Furgeson, Mahoney, and Warfield, Security Vulnerability Assessment of the Cushing Oil Storage Facility. 
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A terrorist attack on the COTH would lack the traditional elements of mass 
causalities and iconic buildings; thus, some local and national authorities dismiss the 
COTH as a possible terrorist target. 59 However, the Department of Homeland Security 
Presidential Directive 7 states, “Terrorists seek to destroy, incapacitate, or exploit critical 
infrastructure and key resources across the United States to threaten national security, 
cause mass casualties, weaken our economy, and damage public morale and 
confidence.” 60 Luft and Korin maintain that terrorist organizations have always been 
interested in targeting oil and gas facilities. In so doing, these groups are able to 
undermine the stability of the governments and weaken foreign powers with vested 
interests in their region. Luft and Korin further assert, that as security heightens around 
transportation networks, military bases and government installations, terrorists looking 
for a big bang might find oil interests. To quote al Qaeda, “the ‘umbilical cord and 
lifeline of the crusader community,’ the object of the next major assault on the west, an 
assault that could wreak havoc with America’s economy and way of life.” 61 Oil and gas 
pipelines have been a favored target of terrorists outside the United States, and the fact 
that terrorist groups have demonstrated the capability and intent to attack pipeline 
systems abroad raises the possibility that similar attacks could occur inside the homeland. 
Al Qaeda’s online magazine, Voice of Jihad , declares that Al Qaeda “should strike 
petroleum interests in all areas which supply the United States.” 62 This online magazine 
listed The Trans Alaskan Pipeline System as a target, but also included links to maps of 
oil facilities in Alaska, Texas, Louisiana, California, and Oklahoma. 63 


59 Anthony L. Kimery, “Petrojihad USA: Policing the Pipelines,” Homeland Security Today, 
September 2007, 

http://www.hstoday.us/index.php?id=483&cHash=081010&tx_ttnews%5Btt_news%5D=556. 

60 U.S. Department of Homeland Security, “Homeland Security Presidential Directive 7: Critical 
Infrastructure Identification, Prioritization, and Protection,” Homeland Security Presidential Directive 7, 
December 17, 2003, http://www.dhs.gov/xabout/laws/gc_1214597989952.shtm. 

6 ' Gal Luft and Anne Korin, “Terror's Next Target,” Journal of International Security Affairs 
(December 2003), http://www.iags.org/n0111041.htm. 

62 Kimery, “Petrojihad USA: Policing the Pipelines.” 

63 Kimery, “US Oil Complex Vulnerable to Attack.” 
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Attacks on oil and gas infrastructure have become the weapon of choice for 
international terrorists, irrespective of the political and social-financial conditions of the 
society under attack. 64 Over 10,000 terrorist attacks occurred during 2011, which affected 
approximately 45,000 victims in 70 countries and resulted in 12,500 deaths. 65 Data from 
terrorist attacks from 2007-2011 shows a sharp rise in the number of attacks directed at 
energy infrastructure, which includes fuel tankers, fuel pipelines, and electrical networks 
that increase from 299 attacks in 2010 to 438 attacks in 2011. During the same period, 
terrorist attacks on public places declined approximately 47%. 66 See Figures 6 and 7. 



Figure 6. Terrorist Attacks on Energy Infrastructure. 67 


64 Friedrich Steinhausler et al., “Security Risks to the Oil and Gas Industry: Terrorist Capabilities,” 
Strategic Insights 7, no. 1 (2008): 1-10. 

65 National Counterterrorism Center, 2011 Report on Terrorism (Washington, DC: Director of 
National Intelligence, March 12, 2012). 

66 Ibid. 

67 Ibid. 
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Figure 7. Terrorist Attacks on Public Places. 68 

Over two-thirds of terrorist attacks in 2011 were directed towards infrastructure or 
critical facilities. Transportation facilities and transportation infrastructure incurred 
damage in 27% of the 2011 attacks. 69 See Figure 8. Steinhausler et al. provide multiple 
scenarios for coordinated attacks to the oil and gas industry and maintain that terrorists 
are likely to deploy coordinated attacks on oil infrastructure. 70 A major interruption of 
service at the COTH or other critical hubs would not only have a severe impact on the 
nation’s oil reserves, but also pose a significant threat to an already suffering economy. 
At any given time, 10-11% percent of the nation’s oil inventory resides in Cushing, and 
this percentage appears likely to rise. By the end of 2012, the added storage capacity at 
the COTH will increase from 46.3 billion barrels to 60.3 million barrels, a 23.7% 
expansion. 71 Seventy percent of the nation’s crude oil flows through the COTH. With the 


68 National Counterterrorism Center, 2011 Report on Terrorism. 

69 Ibid. 

70 Steinhausler et al., “Security Risks to the Oil and Gas Industry: Terrorist Capabilities.” 

71 Furgeson, Mahoney, and Warfield, Security Vulnerability Assessment of the Cushing Oil Storage 
Facility. 
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increase in storage capacity and the completion of the Keystone-XL pipeline, the 
percentage of the daily supply of crude oil flowing through the COTH is likely to 
increase. 



Figure 8. Terrorist Attacks Damaging Facilities by Facility Category. 72 


The decrees issued to A1 Qaeda’s followers to attack U.S. oil facilities were 
designed with the intent to disrupt the flow of oil available to America by bankrupting its 
economy by driving up world oil prices. 73 Any disruption to the flow of domestic oil 
might also increase U.S. reliance on foreign oil sources, which are also vulnerable to 
disruption for various reasons. According to the U.S. Energy Information Administration, 
“Both crude oil and petroleum product prices can be affected by events that have 

72 National Counterterrorism Center, 2011 Report on Terrorism. 

73 Kimery, “US Oil Complex Vulnerable to Attack.” 
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[merely] the potential to disrupt the flow of oil and products to market, including 
geopolitical and weather-related developments.” Crude oil prices and key geopolitical 
and economic events are represented in Figure 9. Selected events, including natural 
disasters, affecting the price of crude from 2001-2011, are represented in Figure 10. 
Furthermore, the EIA indicated that events only need to create uncertainty in oil markets 
and that actual disruptions are not necessary. 

Several major oil price shocks have occurred at the same time as supply 
disruptions triggered by political events, most notably the Arab Oil Embargo in 1973-74, 
the Iranian revolution and Iran-Iraq war in the late 1970s and early 1980s, and Iraq’s 
invasion of Kuwait in 1990. More recently, disruptions to supply (or curbs on potential 
development of resources) from political events have been seen in Nigeria, Venezuela, 
Iraq, Iran, and Libya. 74 


74 U.S. Energy Information Administration, “Energy & Financial Markets—U.S. Energy Information 
Administration (EIA)—U.S. Energy Information Administration (EIA),” What Drives Crude Oil Prices?, 
(n.d.), http://www.eia.gov/finance/markets/spot_prices.cfm. 
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Crude oil prices react to a variety of geopolitical and economic events 

Crude oil prices and key geopolitical and economic events 
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Figure 9. Geopolitical and Economic Influences on the Price of Crude Oil (1970- 

2010). 75 


77 U.S. Energy Information Administration, “Energy & Financial Markets—U.S. Energy Information 
Administration (EIA)—U.S. Energy Information Administration (EIA).” 


24 





$140/barrel 


$120 


$100 


May/June 2008 Saudi Arabia 
announces production increases 

May 2008 Nigerian 
shut-ins rise to 1.4 Mb/d 

Dec 2007 Russian production 
falls for first time since 1998 

May 2007 About 0.8 Mb/d 
of Nigerian oil shut in 


$80 


$60 


$40 


Mar 23,2007 Iran 
seizes Biitish naval vessel 

Feb 24,2006 Terrorists attempt attack on 
Saudi Arabia's Abqaig oil processing facility 


Mar 19,2003 Military 
action against Iraq begins — 

Mar 23,2003 Violence shuts 
down major oil production — 
facilities in Nigeria 

Jan 2003 Strikes shut down 2.6 
Mb/d of Venezuelan production 


Sept 14,2004 Hurricane 
Ivan hits U S. Gulf Coast 


Apr 21,2004 
Terrotist attack 
against Saudi Arabia 


Sept 11,2001 l/ 1 i 

$20 V v 


jrtfAf 




Aug/Sept 200S 
Hurticanes Katrina and 
Rita hit US. Gulf Coast 


-2004 Largest global oil 
demand growth since 1976 




July 3,2008 Oil prices reach S145.31 


Sept 22,2008 U.S. rescue plan 
for financial sector announced 


Sept 15,2008 Lehman 
Bros, files for bankruptcy 


Mar 2011 

1.5 Mb/d of Libyan 

exports shut down 


Aug/Sept 2008 

Hurticanes Gustav 
and Ike hit U.S. 
Gulf Coast 

2nd Half 2008 
Spreading economic 
downturn causes 
large declines in 
global consumption 


Feb 2007 OPEC cuts production 
almost 1 4 Mb/d ovet six months 


June 2004 OPEC spare oil production 
capacity drops under 1 Mb/d 


2003-2007 Rapid global economic growth 


$0 


2001 


2002 


2003 


2004 


200S 


2006 


2007 


2008 


Feb 14-15,2011_ 

Majot piotests in Libya 
and Bahrain break out 



Dec 17,2010 Tunisian 
man sets himself on file 


2009 Global economy starts 
to recover from recession 


Mar 2009 OPEC cuts production 
3 Mb/d ovet eight months 


2009 


2010 


2011 


Notes: Prices are for WTI crude oil, the benchmatk price for the U.S. Mb/d = million barrels pet day. Other events and factors influence oil prices in addition to those listed. 


CRS 04/2011 


Figure 10. Selected Events Affecting the Price of Crude Oil in the United States (2001-2011) 76 


7f) U.S. Library of Congress, Congressional Research Service, U.S. Oil Imports: Context and Considerations, by Neelesh Nerurkar, CRS Report 
R41765 (Washington, DC: Office of Congressional Information and Publishing, April 1, 2011), http://www.fas.org/sgp/crs/misc/R41765.pdf. 


25 


















In August 1979, the GAO warned, in a report to Congress, that pipelines are 
highly vulnerable to disruptions caused by human error, sabotage, or nature and that 
damage to facilities on just a few pipeline systems could greatly reduce domestic 
shipments, which would cause an energy shortage exceeding that of the 1973 Arab oil 
embargo when severe gas shortages created long lines at the gas pumps. 77 Luft and Korin 
conclude that despite the fact that only 28% of American oil was imported during the 
1973 Arab oil embargo, the supply cuts effect on the American economy was profound. 
Oil prices quadrupled in only a matter of weeks. Today, with over half the U.S. crude oil 
supply being imported, the consequences and attack on a major oil installation or choke 
point in the crude oil infrastructure would be worse than the 1973 Arab oil embargo. 78 As 
an example of the strategic importance of oil distribution, former CIA Middle East field 
officer Robert Baer provides the following scenario, which presents an idea of the 
magnitude of a scenario in which oil supply is interrupted by a terrorist attack on oil hubs 
within the Kingdom of Saudi Arabia: 

A terrorist attack...on the Saudi oil complex or a simultaneous attack on a 
few of them is not a fictional scenario. A single terrorist cell hijacking an 
airplane in Kuwait or Bubai and crashing it into Abqaiq or Ras Tanura, 
could turn the complex into an inferno. This could take up to 50% of the 
Saudi oil off the market for at least 6 months and with it most of the 
world’s spare capacity, sending oil prices through the ceiling. Such an 
attack would be more economically damaging than a dirty nuclear bomb 
set off in midtown Manhattan or across from the White House in Lafayette 
square...[this] would be enough to bring the world’s oil-addicted economy 
to their knees, America’s along with them. 79 

For comparison purposes, a major disruption (weeks or months) of the COTH would 
remove approximately 70% of the U.S. crude supply from the market because it serves as 
the major distribution hub for U.S. crude to the Midwest and Gulf Coast states, which 
would be equally consequential as the scenario proposed by Baer. Former CIA director 
James Woolsey admitted that the COTH facility is a “soft target” that is not sufficiently 


77 Kimery, “US Oil Complex Vulnerable to Attack.” 

78 Ibid. 

79 Ibid. 
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hardened against an attack. In light of the strategic importance of the COTH, greater 
protection seems warranted. The oil stored in Cushing has a drastic impact on crude 
pricing. History has shown that when reserves at Cushing are low, prices increase greatly. 
Conversely, when stocks are high, prices plummet. Without a doubt, oil operations at 
Cushing have a global impact. In November 2007, an explosion damaged the Lakehead 
pipeline in northern Minnesota, which caused oil prices to spike an additional four dollars 
per barrel. 80 If the incident had disrupted flow of oil to Cushing, the effect on the market 
would have been more dramatic, possibly doubling the price. The major disruption of 
other critical hubs, such as the Houston Ship Channel, Longview, Texas; Vernon, Illinois; 
and Los Angeles hubs would have similar consequences. Kimery contends the oil market 
is so volatile that any bad news, even erroneous information, has a tremendous effect on 
pricing. 81 

Critical infrastructure systems represent an enormous public investment 
where even minor disruptions can degrade the system’s performance 
resulting in significant economic losses. 82 It is well within the realm of 
reality that a terrorist or other organization can identify critical hubs in the 
U.S. crude pipeline system by using information free available in the open 
source literature. 83 The A1 Qaeda training manual states that by using open 
source information, it is possible to gather at least 80% of information 
about the enemy necessary to inflict terror. 84 Brown, et al. of the Naval 
Postgraduate School found that free, open source information often 
provides 100% of the information required to plan a devastating attack on 
an infrastructure system. 85 

The literature available regarding the vulnerability and hence, protection, of the U.S. 
crude pipeline infrastrcucture is lacking. 


80 Kimery, “US Oil Complex Vulnerable to Attack.” 

81 Ibid. 

82 G. Brown et al., “Defending Critical Infrastructure,” Interfaces 36, no. 6 (November 1, 2006): 530. 

83 Ibid., “Al Qaeda Training Manual,” (n.d.), http://www.fas.org/irp/world/para/manualpartl.html. 

84 “Al Qaeda Training Manual.” 

85 Brown et al., “Defending Critical Infrastructure,” 530. 
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B. PROBLEM SPACE AND HYPOTHESES 


Critical infrastructure systems represent an enormous public investment in which 
even minor disruptions can degrade the system’s performance and result in significant 
economic losses. 86 It is well within the realm of reality that a terrorist or other 
organization can identify critical hubs in the U.S. crude pipeline infrastructure by using 
information free available in the open source literature. 87 ' 88 Consequently, Lewis 
proposes that network analysis is one way to cope with size and complexity of a complex 
system. 89 A network analysis of the U.S. crude infrastructure pipeline system was 
conducted to identify critical components of the U.S. crude pipeline infrastructure. While 
a significant number of publications on single points of failure with regards to individual 
pipeline components do exist, network analysis of the crude infrastructure in the open 
literature does not. 

The boundaries of this inquiry revolve around the U.S. crude pipeline 
infrastructure. Neither refined product or natural gas distribution pipelines were 
evaluated. Refined product and natural gas pipeline systems are separate from the crude 
oil pipeline infrastructure. The assumptions made are that the crude oil pipeline maps 
purchased from Rextag (http://www.rextagstrategies.com) correctly identify the pipeline 
locations that crisscross across the United States and that the proposed network analysis 
program accurately reflects the U.S. crude pipeline infrastructure represented in a 
network form. 

2. Significance of Research 

The significance of this inquiry is that critical hubs and critical links can be 
identified in the crude pipeline infrastructure, so that it is then possible to understand 
better how to protect the hubs from catastrophic loss due to natural or non-natural threats. 
Network analysis has been applied in other infrastructure sections to identify 

86 Brown et al., “Defending Critical Infrastructure,” 530. 

87 Ibid. 

88 “Al Qaeda Training Manual.” 

89 Lewis, Critical Infrastructure Protection in Homeland Security: Defending a Networked Nation , 22. 
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vulnerabilities. 90 The U.S. economy and other critical infrastructure sectors are 
completely dependent on the timely and efficient delivery of crude oil to refineries. Crude 
oil is refined into a variety of other products, such as gasoline, diesel, heating oil, and jet 
fuel and then delivered to market. Should the delivery of a crude oil distribution system 
suffer a major disruption, the economy of the United States and the world would be 
significantly affected in a negative way. The hubs are the main source of vulnerability to 
the U.S. pipeline systems. 91 By identifying and protecting critical hubs in the crude 
pipeline infrastructure, it is possible to ensure delivery of crude oil and crude-based fuels, 
products, and lubricants to maintain the economic well being of the United States. 

3. Hypotheses 

The hypotheses are the following. 

• The U.S. crude oil pipeline infrastructure is a complex network centered 
around one or more critical hubs. 

• The U.S. crude oil pipeline infrastructure is subject to preferential 
attachment. 

• The U.S. crude oil pipeline infrastructure is subject to cascade failure. 


90 Jian-Wei Wang and Li-Li Rong, “Cascade-based Attack Vulnerability on the US Power Grid,” 
Safety Science 47, no. 10 (December 2009): 1332-1336; P. Li et al., “A Limited Resource Model of Fault- 
tolerant Capability Against Cascading Failure of Complex Network,” The European Physical Journal B 62, 
no. 1 (March 19, 2008): 101-104; Eric Taquechel, “Layered Defense: Modeling Terrorist Transfer Threat 
Networks and Optimizing Network Risk Reduction,” IEEE Network (November/December 2010); Christos 
Nicolaides et al., “A Metric of Influential Spreading During Contagion Dynamics Through the Air 
Transportation Network,” PLoSOne 7, no. 7 (July 2012): 1-10. 

91 Lewis, Critical Infrastructure Protection in Homeland Security: Defending a Networked Nation, 

295 . 
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III. METHOD 


The U.S. crude oil pipeline infrastructure was analyzed using the MBRA software 
tool developed by the Naval Postgraduate School Center for Homeland Defense and 
Security. This network analysis tool derives its results from the input of a network of 
nodes and its respective links by the software user. 

The data for the analysis were gathered from crude pipeline maps published by 
Rextag. The crude pipeline maps identify transfer stations, pipelines, refinery locations, 
liquid storage terminals, and hubs in the U.S. crude pipeline infrastructure. These 
locations, pipelines, and refineries were entered into the MBRA software and the pipeline 
infrastructure represented as a network so that the network analysis could be conducted. 

The output of the MBRA analysis assists the user in making objective decisions 
about the various variables inherent within the network in an effort to reduce risks and/or 
vulnerability within the network. The MBRA approach consists of two key components 
that assist the user in the analysis. These two components are network analysis and fault 
tree analysis, which do not necessarily have to be performed together. For the study of 
the crude oil pipeline infrastructure, the network analysis tool was utilized to determine 
which components of the network were most critical. The critical nodes identified by the 
analysis were ranked in order of their importance. 

The MBRA software tool was chosen for this study due to its indifference in the 
system being analyzed. The MBRA method can be utilized on networks in which the link 
or nodes are tangible or intangible; thus, its applications range from the analysis of 
aqueduct systems to social networks. The universality of the software program and its 
systematic and methodical approach in the analysis of a network provided enough 
support to choose it as the tool to analyze the crude oil pipeline infrastructure to identify 
the critical nodes in the network. In the crude oil pipeline network, the nodes or areas of 
convergence or intersection are the most susceptible to damage or destruction, either by 
mechanical failure, natural events, or third-party intervention, which include damage by 
employees or terrorist activities. The MBRA software tool can then be used to analyze 
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the nodes’ risk and vulnerability to identify the critical nodes within the network. The 
benefit of using the MBRA is to minimize risk in the crude oil pipeline network while 
determining the most efficient allocation of funds to the critical nodes identified in the 
network. 92 

The MBRA program estimates a power curve that can be utilized to determine the 
likelihood that a failure in the network will lead to a cascading failure and be utilized to 
assess system vulnerability. The MBRA program calculates a power law exponent, which 
identifies system resiliency against cascade failure. 

Exceedence probability curves follow a power law and are commonly used in the 
insurance industry to assess risk. Power laws can be utilized to assess risk for nearly all 
hazards of interest to homeland security and safety engineering. The power law exponent 
dictates the steepness of the curve. Exponents greater than one indicate a resilient 
network. In other words, the higher the exponent, the lower the risk. Exponents less than 
one indicate a network at risk of a system-wide cascade failure. In this case, the lower the 
exponent, the higher the risk. Power law curves with exponents lower than 1.0 can be 
described as having a “fat tail” or “long tail.” This fat tail indicates a higher probability of 
network vulnerability to cascade failure. This vulnerability indicates an increased risk for 
a Black Swan event. Black swan events are extreme and abnormal events responsible for 
large adaptations in nature, as well as human and system evolution. 93 

The terrorist attacks of 9/11 and the financial meltdown of 2008 are two examples 
of Black Swan events, which are considered as such because of their low probability, 
high consequence, and vast global ripple effect. The key to preventing Black Swans is to 
avoid too many links and large hubs to decrease connectivity. Connectivity increases the 


92 Taquechel, “Layered Defense: Modeling Terrorist Transfer Threat Networks and Optimizing 
Network Risk Reduction.” 

93 Ted Lewis, Bak’s Sand Pile: Strategies for a Catastrophic World (Williams, CA: AGILE Press, 
2011), 35, 48, 65; Nassim Nicholas Taleb, The Black Swan: The Impact of the Highly Improbable (New 
York, NY: Random House, 2010); Ian Bremmer and Preston Keat, The Fat Tail: The Power of Political 
Knowledge for Strategic Investing (New York: Oxford University Press, 2009). 
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probability of a Black Swan event because of ripple effects due to dependence on 
connectedness, which allows a mechanism for seemingly insignificant events to magnify 
consequences. 94 

The x-axis on the power law curves in Figure 10 measure a percentage of the total 
consequence sum of the network, and the y-axis measures the percentage chance that a 
certain percentage of that sum will fail. For example, in Figure 11, a 9% chance exists 
that at least 8% of the “Entire Nation” network will fail as the result of a single initiating 
failure. For the PADD V network, note that an 18% chance exists that at least 8% of the 
network will fail as the result of a single initiating failure. 95 


“Fat Tail” or “Long Tail” = 
System is subject to 
cascade failure. 



There is a9% chance 
that >8% of the network (x- 
axis) will fail as result of a 
single initiating failure. 


There is an 18% chance 
that >8% of the network! x- 
axis) will fail as result of a 
single initiating failure. 


Figure 11. Representation of Power Law Curves and Exceedence Probability. 


The analysis will determine if the crude oil infrastructure networks are susceptible 
to cascade failure and define critical hubs in the system. This information can be utilized 
to prepare recommendations to protect networks and critical hubs in the network model. 


94 Lewis, Bak’s Sand Pile: Strategies for a Catastrophic World, 35, 90. 

95 CHDS. “Model-Based Risk Analysis User Guide,” (n.d.), 20-21, 
http://www.chds.us/?media/resources&collection=53&type=SIMULATION. 
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A. SOURCES OF DATA 

The data gathered for the analysis of the crude oil pipeline infrastructure were 
obtained through RexTag Strategies. Information contained within the maps regarding 
the crude oil pipelines utilized included the pipelines, oil refineries locations, liquid 
terminals, large oil fields, and oil seaports. The pipelines were input into the MBRA 
software directly while the other information listed above was used to determine the 
direction of oil flow through the network. 

B. TRANSFER OF DATA INTO MBRA SOFTWARE 

The pipelines were entered into the MBRA software, with the areas of 
convergence of multiple pipelines intersecting on the map denoted as nodes. Nodes were 
placed in areas where oil entered the system and where they exited the system, as in the 
case with the refineries denoted by red flags. Nodes were also identified in the system 
where pipelines crossed the U.S. border. The MBRA representation of the crude oil 
pipeline network is shown in Figure 12 and the representation of the links, nodes, and 
hubs are depicted in Figure 13. It should be noted that with the use of the MBRA 
software, the maps within the software were used purely for the individuals inputting the 
information into the program and had no effect on the analysis itself. Results derived 
from the MBRA analysis are determined by the relationship of the nodes and links and 
not the geospatial characteristics as observed on the map. In the case of this study, it was 
necessary to use the map to systematically put each pipeline in the MBRA software so as 
to compare it with the maps provided by RexTag Strategies and the National Geospatial- 
Intelligence Agency to ensure accuracy and avoid inadvertent omissions. 
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Figure 12. MBRA Representation of the Crude Oil Pipeline Network 


Figure 13. Nodes, Links, and Hubs, Arrows Indicate Direction of Flow 



Assumptions of the investigators while inputting the data into the MBRA 
software included the direction of flow of the crude oil in the pipeline system and the 
application of virtual seaports. Rigorous investigation into pipeline maps did not lead to 
the determination of flow or pipe diameter. This minor setback was circumvented 
through the meticulous examination of each pipeline within the network and tracing each 
pipeline to its origin and final destination (refinery or seaport). The virtual seaports were 
entered into the MBRA software to represent the flow of oil via ship into and out of the 
network. 
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C. METHOD OF VALUE ASSIGNMENT 

The MBRA software models the effects of security improvements at nodes, which 
in turn determines the overall network risk, but it does not provide initial threat, 
vulnerability, or consequence inputs. 96 These values, shown in Tables 1 and 2, were 
developed through analysis of past oil industry losses and were inputted in the MBRA 
software. A multiplier was applied to the original value assignment if the node or link 
were located or traveled through a high consequence area as identified in Figure 4. These 
values were objectively applied to each node and link within the entire network. The 
values for the threat and vulnerability of each node and link inputted into the system 
throughout the network are a percentage representing the probability of an attack 
occurring, and consequently, succeeding. The consequence applied to each node and link 
was the estimated costs of failure for each particular component in the system. Costs of 
component failure were estimated based on loss estimates of a single Gulf Coast refiner 
from both a 3-day and a 10-day interruption of service, in which direct (economic losses 
to the refiner) and indirect (losses due to reduced demand from suppliers and reduced 
sales by customers) were $97 million (3-day interruption) and $405 million (10-day 
interruption) per incident. 97 The maximum node value assignment was $20 billion, which 
was arrived at by using the $20 billion figure BP placed in escrow to repay those who had 
losses associated with the BP/Macondo/Deepwater Horizon incident. 98 Adjustments for 
environmental and human casualty considerations were accounted for by the multipliers 
depicted in Table 3. 

Due to the increase of the consequence because of location on a waterway at the 
Houston Ship Cannel hub, the COTH was given equal consequence node value 
assignments as those, such as the Houston Ship Channel Hub to account for the critical 

96 CHDS. “Model-Based Risk Analysis User Guide,” 20-21. 

97 Scott Dynes, Eva Andrijcic, and M. Eric Johnson, “Costs to the U.S. Economy of Information 
Infrastructure Failures: Estimates from Field Studies and Economic Data,” Proceedings of the Fifth 
Workshop on the Economics of Information Security, Cambridge University, 2006, 
http://www.tuck.dartmouth.edu/cds-uploads/publications/pdf/Paper_WEIS_Costs.pdf. 

98 BP, “BP Establishes $20 Billion Claims Fund for Deepwater Horizon Spill and Outlines Dividend 
Decisionsl Press Release I BP," June 16, 2010, 

http://www.bp.com/genericarticle.do?categoryld=2012968&contentld=7062966. 
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nature of the COTH to the U.S. pipeline infrastructure. The threat parameter for the 
Houston Ship Channel hub was decreased to 50% because of the high activity level in the 
ship channel, law enforcement presence, and the significant presence of industrial 
facilities surrounding the Houston Ship Channel Hub. Threat and vulnerability 
assessments for the Houston Ship Channel and the COTH were conducted with input 
from federal, state, and local law enforcement representatives at the Naval Postgraduate 
School’s Center for Homeland Defense and Security. An example of the relative threat 
level and vulnerability between the COTH and Houston Ship Channel is represented in 
Figure 14. Virtual seaports nodes were assigned threat level of 20% and a vulnerability 
level of 20 percent. All other threats and vulnerabilities levels were assigned as described 
in Tables 1-3. 



Figure 14. Houston Ship Channel Oil Transfer and Storage Facility Hub (Left) Is 
Located in an Active Terminal Area Surrounded by Industrial Facilities 
and a Very Busy Waterway, While the COTH Is Isolated with in an Area 
with Low Activity and Easy Access to the Facility 
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Degree 

Threat 

Vulnerability 

Consequence $(millions) 

1 

20% 

100% 

25 

2 

30% 

100% 

250 

3 

40% 

100% 

500 

4 

50% 

100% 

1,000 

5 to 7 

65% 

100% 

5,000 

8 to 10 

80% 

100% 

10,000 

>10 

100% 

100% 

20,000 


Table 1. Node Value Assignments 


Criteria 

Threat 

Vulnerability 

Consequence $(millions) 

Within 1 state 

25% 

25% 

25 

Crosses 2 states 

50% 

50% 

100 

Crosses 3 states 

75% 

75% 

250 

Crosses 4 states 

100% 

100% 

500 


Table 2. Link Value Assignments 


Consequence 

Inland Waterway "OR" Coastal ■=> 
Increased population 


4X (original amount) 
4X (original amount) 


Table 3. Consequence Adjustment Factors 
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D. 


PARAMETERS OF THE ANALYSIS 


The network was analyzed using the parameters of degrees and betweenness, with 
the objective function of identifying risk. Degrees represent the number of links 
connected to a specific node. The degrees of each node were used to calculate the overall 
impact each individual node had on the system. Betweenness accounts for the number of 
paths traveling through a specific node. This parameter is valuable in the analysis given 
that a node with a small degree could still have a significant impact of the flow through 
the network under certain circumstances. Finally, the objective function of risk was 
selected since this study centered on the identification of the critical nodes in the 
network. A separate simulation for the entire nation was conducted on the flow 
parameter. 


1. Project Assumptions/Notes 

1. Pipelines and oil basins in the Gulf of Mexico were excluded with the 
exception of seaports/pipelines/terminals where oil is brought into the U.S. 
pipeline system. Shipping routes crossing into the coastal United States 
are represented as a node on the coast linked to the pipeline system. 

2. Pipelines crossing Mexico/Canada border are designated as nodes at the 
border linked to the pipeline system. 

3. Links were assigned the same name as shown on map. 

4. Assign nodes with the sequence name starting with a PADD number 
followed by the node’s numerical sequence; e.g., the first node in PADD 
V would be “5.1.” 

5. A hub is defined as the areas of convergence at which multiple pipelines 
intersect on the map. 

6. The MBRA network was based on the RexTag Map REX-WM-030 U.S. 
Crude Oil Pipelines. 

7. Liquid storage terminals are not included in the MBRA network. 

8. Virtual seaports are utilized to represent sea routes. 
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2. Hypothesis Testing 


Each hypothesis was tested using the following methods. 

• Hypothesis 1: The U.S. crude oil pipeline infrastructure is a complex 
network centered around one or more critical hubs. 

• Testing Method: MBRA Network Analysis, Identification of 
Critical Hubs 

• Hypothesis 2: The U.S. crude oil pipeline infrastructure is subject to 
preferential attachment. 

• Testing Method: MBRA Network Analysis, Literature Review, 
Exceedence Probability 

• Hypothesis 3: The U.S. crude oil pipeline infrastructure system is subject 
to cascade failure. 

• Testing Method: MBRA Network Analysis, Exceedence 
Probability 
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IV. RESULTS AND ANALYSES 


The MBRA software tool used the degrees and betweenness of each node to 
determine the risk in the crude oil pipeline infrastructure network. The MBRA analysis 
identified the five most critical hubs in the crude oil pipeline network for the entire 
nation. These critical hubs, identified in descending order of criticality are as follows. 

1. Cushing, Oklahoma (COTH) 

2. Houston, Texas (Houston Ship Channel) 

3. Vernon, Illinois 

4. Texas City, Texas 

5. Longview, Texas 

Another output of the MBRA software was the exceedence probability of the 
network. Exceedence probability follows a power law, as recognized in complex systems 
and statistical physics." It can be used to determine the likelihood a failure in the 
network will lead to a cascading failure, or the probability that an event of x size or larger 
will occur within a system and not simply a system component. 100 The process of 
analyzing the crude oil pipeline network was applied to each individual PADD to 
determine its respective critical nodes and identify the likelihood of a cascading failure. 
The parameters of the analysis remained the same, with the degrees and betweenness of 
each node in the PADD used to identify the risk within each respective network. The 
likelihood of a cascading failure increased across the country moving from PADD I to 
PADD V. The highest ranked critical node identified in each PADD were the following. 

1. PADD I: the virtual seaport off the east coast representing ocean-shipping 

routes 

2. PADD II: Cushing, Oklahoma (COTH) 

3. PADD III: Houston, Texas 


" Ian Dobson et al., “Complex Systems Analysis of Series of Blackouts: Cascading Failure, Critical 
Points, and Self-organization,” Chaos 17, no. 2 (2007): 1-33. 

100 Ted Lewis, Model-Based Risk Analysis of Complex Networks (Center for Homeland Defense and 
Security, n.d.). 
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4. PADD IV: Platte County, Wyoming 

5. PADD V: Los Angeles, California. 

Table 4 details the results of the exceedence probability for the crude oil pipeline 
network in each PADD and the national network. Results indicate that PADDs II and IV 
are susceptible to cascade failure as both have an exceedence probability exponent less 
than 1. PADD I maintains the most resilient network, while the nation’s network 
exceedence probability exponent is 1.1655. 


Exceedence Probability Exponent 

PADD 

Exponent 

1 

1.4909 

2 

<0.8307 

3 

1.1485 

4 

1.0257 

5 

0.3943 

Entire Nation 

Network 

1.1655 


Table 4. Exceedence Probability by PADD 


A. KEYSTONE-XL PROPOSED ROUTE 

The Keystone-XL proposed route through Steele City, Kansas down to the COTH 
via the Keystone Cushing Expansion, and again down to Nederland, Texas to serve the 
Port Arthur, Texas refinery complex was analyzed in the MBRA program. The proposed 
route of the Keystone-XL pipeline is depicted in Figure 4. 
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The addition of the proposed Keystone-XL route increased the exceedence 
probability exponent from the current value of 1.1655 for the entire nation to 1.4028, 
which indicates a 16.9% increase in network resiliency to cascade failure. See Figure 15. 


100 % 1 
s- 

g m 75% ■ 
-g * 

# -S 50% 
a o 

Q. 

25% 


Entire Nation 
Exponent = 1.1655 



Entire Nation ♦ 
Keystone XL Pipeline 
Exponent - 1.4028 


12S4S67S9 
% Consequence (C) 



% Consequence (C) 


Note the “fat tail” of the existing crude oil pipeline network suggesting “long tail” risk of a Black 
Swan event vs. the proposed network with the addition of the Keystone-XL pipeline with a 
tapering “short tail.” 

Figure 15. Exceedence Probability (y-axis) of the Existing National Crude Oil 
Pipeline Network with and without the Keystone-XL Pipeline Proposed 
Route Represented in the Network Analysis 


Probable Maximum Loss Risk (PMLRisk) was calculated by applying exceedence 
probability to risk assessment science. PMLRisk is the expected loss due to a hazard of 
size x or larger and is a worst-case estimate of consequence, rather than an average-case 
estimate, which is commonly used to assess risk. Lewis defines PMLRisk as: 101 

PMLRisk = Exceedence Probability x Consequence. 

The application of PMLRisk to the existing U.S. crude oil pipeline infrastructure 
with the proposed addition of the Keystone-XL pipeline to the national network resulted 
in a PMLRisk profile as described in Ligure 16. The addition of the Keystone-XL 


Lewis, Model-Based Risk Analysis of Complex Networks. 
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pipeline to the existing crude oil pipeline infrastructure reduces PMLRisk by 55% 
(PMLRisk is highest at the highest consequence). The percent decrease in risk was 
calculated by the following formula: 

Percent Decrease = (PMLRisk Existing Network—PMLRisk Addition of 

Keystone-XL)/(PMLRisk Existing Network). 


PMLRisk vs. Consequence 
Crude Oil Pipeline Infrastructure 



0 2 4 6 8 10 


Consequence % 


Ligure 16. PMLRisk vs. Consequence for the Existing Crude Oil Pipeline Network 
and with the Addition of the Keystone-XL Pipeline to the Network 


B. KEYSTONE-XL ALTERNATIVE ROUTES 

Alternatives were considered to determine if re-routing the Keystone-XL could 
increase the resiliency of the nation’s crude network against cascade failure. Live 
alternative routes were evaluated against the network with the Keystone-XL proposed 
path. Results indicate that the proposed Keytsone-XL path had the highest exponent and 
presented the most resilient option. See Ligure 13. Route options are limited to the West 

by the Rocky Mountain Range and to the East by distance, the Great Lakes, Mississippi 
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River, and a lack of refining capacity. U.S. refining capacity is highly concentrated along 
the Gulf Coast between Galveston, Texas and Baton, Rouge, Louisiana. 102 Table 5 lists 
the exceedence probability exponent of each alternative. 

The alternative routes evaluated were the following. 

1. Keystone-XL directly to Houston 

2. Keystone-XL through Childress, Texas and Cushing and down to Houston 

3. Keystone-XL through Childress and to both Cushing and Houston (from 
Childress) 

4. Keystone-XL through Cushing and down to Houston (avoids Keystone 
Cushing Expansion at Steele City, Kansas) 

5. Keystone-XL through Wood River, IL and down to Houston 


Exceedence Probability Exponent 

Alternative 

Exponent 

Actual Proposed 
Path 

1.40 

1 

1.12 

2 

1.06 

3 

1.38 

4 

1.12 

5 

1.16 


Table 5. Exceedence Probability Exponent by Alternative. 


102 Lewis, Critical Infrastructure Protection in Homeland Security: Defending a Networked Nation, 
297-298. 
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Regardless of alternative route, each simulation sequence identified the COTH as 
the most critical hub in the network. See Figure 17. Figure 17 represents the critical hubs 
identified for each alternative route for the proposed Keystone-XL pipeline. In each 
instance, the COTH remained the most critical hub in the national crude oil pipeline 
network. 
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MBRA Critical Nodes (l=highest risk) 


U.S. Crude Infrastructure MBRA Critical Hub Analysis 
(simulated on degrees, betweenness, cascade) 




Cushing Hub ( OK) 
Longview Hub (TX) 
Vernon Hub (Mo) 
Wyoming Hub 
Childress Hub (TX) 
Port Arthur Hub (TX) 
Houston Hub (TX) 


Figure 17. Critical Hub Analysis of Existing Network vs. Alternatives Routes for the 
Proposed Keystone-XL Pipeline 


47 




C. CRITICAL HUBS IN INDIVIDUAL PADDS 

MBRA simulations of the crude oil infrastructure networks within each individual 
PADD were conducted to determine the critical components of the crude oil 
infrastructure network for each PADD. The critical components for each PADD are as 
follows. 

1. PADD I 

1. Ocean-shipping routes 

2. Boca Raton, Florida 

3. Portland, Maine 

4. Shipping route from Newport, Vermont, where crude enters the country 
from Canada to the hub at Portland, Maine 

5. Buffalo, New York 

2. PADD II 

1. Cushing, Oklahoma 

2. Vernon, Illinois 

3. Chicago, Illinois 

4. Toledo, Ohio 

5. Cleveland, Ohio 

3. PADD III 

1. Houston, Texas 

2. Texas City, Texas 

3. Singleton, Texas 

4. Ballinger, Texas 

5. Coleman, Texas 

The critical hubs for PADD III are concentrated in Texas, with the Gulf Coast 
region of Texas being critical to the successful operation of PADD III. See Figure 18. 
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4. PADDIV 

Due to the lack of geographic landmarks that would aid in naming particular hubs 
in the Wyoming area, the critical hubs in PADD IV are represented pictorially in Figure 
19. 



Figure 19. Pictoral Representation of Critical Hubs in PADD IV in the State of 
Wyoming. 
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5. PADD V 

1. Long Beach, CA (Los Angeles) 

2. Ocean shipping routes Canada and Alaska 

3. Crockett, California 

4. La Palma, California 

5. Thousand Oaks, California 

D. FLOW SIMULATION 

The MBRA was run for the entire nation and simulated against the MBRA 
parameter for flow. The results showed an equal exceedence probability exponent to the 
original simulation, which considered betweenness, degrees, and risk. This may have 
occurred because actual flow rates were not available and could not be calculated or 
estimated from the pipeline maps since pipeline diameter and parallel configurations 
were not provided. Thus, the flow simulation may not be a valid estimation of the risk 
associated with flow rate in the national crude oil pipeline system. 

1. Hypothesis Testing Results 

• Hypothesis 1: The U.S. crude oil pipeline infrastructure is a complex 
network centered around one or more critical hubs. 

• Result: The MBRA network analysis identified critical hubs for the 
entire national network, as well as regional networks within each 
PADD. 

• Decision: Accept Hypothesis 1. 

• Hypothesis 2: The U.S. crude oil pipeline infrastructure is subject to 
preferential attachment. 

• Result: The MBRA network analysis identified critical hubs for the 
entire national network whereby new pipelines could be attached. 
Five alternatives routes for the Keystone-XL pipeline were 
evaluated. The proposed route to the COTH and down to Houston 
provided the most resilient network in the analysis. 

• Decision: Accept Hypothesis 2. 


50 



• Hypothesis 3: The U.S. crude pipeline infrastructure system is subject to 
cascade failure: 

• Result: The MBRA network analysis identified PADDs II and IV 
as being subject to cascade failure. Critical hubs for the entire 
national network, as well as regional networks within each PADD, 
were identified whereby disruption of the critical hubs could cause 
cascade effects. 

• Decision: Accept Hypothesis 3. 
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V. DISCUSSION 


Pipelines often span long distances traveling through remote and sometimes 
vulnerable areas. For this reason, they are considered soft targets. Protecting all 55,000 
miles of the U.S. crude oil pipeline would be a daunting, costly, and ultimately, 
unachievable task. However, protecting the U.S. crude oil pipeline network as a whole is 
a very achievable goal. This analysis was performed with the purpose of identifying the 
most critical parts of the U.S. crude oil pipeline network. Pipeline operators have said for 
many years that what constitutes a critical asset has not been well defined and is open to 
interpretation, which makes securing them a challenge. 103 By having a clear 
understanding of where the most critical parts of the network are located, it is then 
possible to better protect the entire network. The results of this analysis should be used as 
a starting point to increase the effectiveness of resources used to secure the crude oil 
pipeline network. 

In parts of the Middle East, interruptions of the crude oil pipeline network are 
commonplace as a result of terrorist attacks. It does not require much in the form of 
manpower or resources to successfully attack a pipeline, refinery, or oil tanker. 104 
Fortunately, the United States does not experience these types of interruptions on a 
regular basis. While terrorism is always a threat to the network, failures such as the BP 
Texas City refinery explosion and the Deepwater Horizon/BP incident can be equally as 
damaging but much more preventable. 105 Safety and security are intertwined, and each 
should be considered when taking steps to increase the robustness of the crude oil 
pipeline network. Currently, the largest threat to the pipelines in the network is corrosion, 


103 U.S. Library of Congress, Congressional Research Service, Pipeline Safety and Security: Federal 
Programs, by Paul W. Parfomak, CRS Report RL33347 (Washington, DC: Office of Congressional 
Information and Publishing, Updated February 29, 2008). 

104 Steinhausler et al., “Security Risks to the Oil and Gas Industry: Terrorist Capabilities.” 

105 Michael D. Larranaga et al., Incident Analysis: Macondo Prospect 252-1 Deepwater Horizon Well 
Control Incident (Boots & Coots Center for Fire Safety & Pressure Control: Oklahoma State University, 
2011); Michael D. Larranaga et al., Incident Analysis: H1-ST1 Development Well: Montara Wellhead 
Platform Release (Boots & Coots Center for Fire Safety & Pressure Control: Oklahoma State University, 
2011 ). 
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which is difficult to detect and can lead to large leaks that result in ecological damage, 
monetary loss, and possibly, loss of life from ensuing explosions. 106 Maintaining the 
structural integrity of the networks pipelines and refineries is equally as important as 
securing the network from possible terrorist attacks. A culture of safety and security is 
cmcial to network integrity. 

The results from the nationwide network analysis indicate that the network as a 
whole is fairly robust and well designed from crude delivery standpoint. The analysis 
identified several areas of increased risk of cascade failure, which could cause a large 
interruption in the network and interrupt delivery to certain portions of the country as a 
result of a terrorist attack, natural disaster, or other catastrophic event. The analysis 
calculated the exceedence probability of the network and the network within each 
individual PADD. It is recommended that the five most critical nodes in the national 
crude oil pipeline infrastructure be assessed more thoroughly to ensure they are not 
vulnerable. The network should also be assessed to identify how design changes could 
lessen the criticality on these nodes and spread the risk more throughout the network. A 
more robust network would help lessen the impact of a high consequence event causing a 
cascading failure (Black Swan). 

The results indicate that PADD II and PADD V are susceptible to cascade failure, 
with PADD V being the most vulnerable. Due to the geography of the region, PADD V is 
independent from the rest of the country. The isolation of PADD V combined with the 
realistic scenario of a cascading event due to a terrorist attack or other catastrophic 
incident, is cause for concern and should be evaluated further. The COTH is located in 
PADD II. Considering the critical nature of the COTH and other hubs, it is recommended 
that some physical barrier, such as a National Guard facility or military base, be 
constructed around the COTH to prevent a terrorist attack and provide resources for a 
large-scale response to the COTH. This type of physical barrier would limit access to the 
COTH, an increased law enforcement presence associated with facilities of this type, an 
increased fire department response capability, and simply, an increase in the number of 

106 Parker “The Pipeline Industry Meets Grief Unimaginable: Congress Reacts with the Pipeline 
Safety Improvement Act of 2002.” 
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security-vetted personnel able to observe facility boundaries. Undoubtedly, local citizens, 
environmental groups, many politicians, and others would view this disruptive suggestion 
negatively. However, the catastrophic loss of the COTH and other critical hubs within the 
crude oil pipeline network would lead to long-standing and negative, political, economic, 
and social implications that likely outweigh negative factors associated with leaving the 
hubs vulnerable. Regardless of whether this recommendation is accepted or not, 
hardening with regards to security of the COTH and critical hubs in each PADD, should 
be completed to protect against catastrophic interruption of service from terrorist attack. 

This hardening of critical hubs should include components of the concept of 
Integrated Physical Protection (IPT) consisting of the following. 107 

1. State-of-the-art technical, and operational countermeasures to enable 

management to reduce the probability of success of a terror attack. 

2. Increased emphasis on a corporate security culture, and thereby, 
strengthen corporate resilience to consequences of a terror attack and 
minimize the insider threat. 

3. Continuous security training at all levels to reduce the probability for the 
occurrence of a terror attack and to reduce downtime after a terror attack. 

4. Regular threat and risk assessment activities to identify, qualify, and 

quantify risks and countermeasures in a changing and complex 

environment. 

5. Evaluation and update of strategies and countermeasures based on risk 
analyses by considering the cost benefit factor. 

6. Strengthen cooperation between private owners of the facilities, related 
government security agencies, law enforcement, and first responders. 

The addition of the proposed Keystone-XL pipeline increases the resiliency of the 
cmde oil pipeline infrastructure against cascade failure and significantly reduces the 
PMLRisk associated with a Black Swan event. Hence, the potential for a catastrophic loss 
of U.S. capacity to distribute oil to refineries throughout the United States is greatly 
reduced by the addition of the Keystone-XL pipeline to the network. The Obama 
Administration should reconsider its controversial denial of a permit to complete the 
Keystone-XL pipeline that will carry oil from Alberta, Canada to the COTH. 


107 Steinhausler et al., “Security Risks to the Oil and Gas Industry: Terrorist Capabilities.” 
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A. STRENGTHS/WEAKNESSES OF MBRA 

A major advantage of using the MBRA method is that it directs attention to the 
most critical areas in a network subsequently to aid in minimizing those areas at greatest 
risk from disruption. Consequently, a potential disadvantage is that this process could 
overlook smaller links and nodes in the system. With a majority of the focus being on the 
critical nodes following the analysis, the smaller components in the system could be left 
vulnerable to degradation or attack with the potential of cascading effects within the 
system. 

Another disadvantage in the analysis of the network is that the MBRA program 
does not allow for the representation of the multiple lines, in this case, pipelines running 
in parallel, originating and terminating at identical nodes. This insufficiency has the 
potential to influence the output of the analysis adversely given that one of the parameters 
of the model analysis is degrees (or number of pipelines that connect to individual 
nodes). This parameter of the analysis calculates the number of links entering and leaving 
each node in the network to determine its significance within the system. Another 
weakness of the program is its lack of identification of the source and sink nodes in the 
network that would be useful to the analysis due to the higher significance these 
components play in the actual system. 

Regardless of the weaknesses, the MBRA network modeling and analysis tool 
provides valuable insight into the risks associated with attack vulnerability and cascade 
failure of a network system. The MBRA tool provides a mechanism to compute probable 
maximum loss risk. Network modeling is perhaps the simplest method of representing 
and analyzing systems of all sizes, regardless of their complexity while embracing system 
components and relationships among components. In addition, the MBRA calculates 
exceedence probabilities of cascade failure within a system. This calculation is ideal 
because network failures are systemic and cascade failures commonly occur in complex 
systems, such as power grids, nuclear power plants, telecommunication systems, and 
Internet exploits. 108 As such, the results of this study suggest that emphasis should be 

108 Lewis, Model-Based Risk Analysis of Complex Networks. 
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placed on critical hubs to protect the entire network from cascade failure. It is not 
suggested that any other component of the nation’s crude pipeline infrastructure be 
ignored from either a security or safety standpoint. 
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VI. CONCLUSION 


Much of the crude oil pipeline infrastructure is vulnerable to catastrophic failure 
and has served beyond its intended design life. Protecting all 55,000 miles of the U.S. 
crude oil pipeline infrastructure from catastrophic failure is an unachievable goal. 
Protection of the network can be achieved by protecting hubs from catastrophic failure, 
allocating resources to critical hubs, and by employing the concepts of integrated 
physical protection. In addition to protecting the five most critical hubs in the entire U.S. 
crude oil pipeline network, critical hubs in each PADD should be protected. 

The resiliency of the crude oil pipeline infrastructure is vital to sustain the U.S. 
economy, military, and standard of living. The analysis has identified key areas within 
the network that require additional attention to ensure their integrity. A key concept to 
alleviate the risk across a network is to incorporate redundancy through the design of 
additional hubs positioned strategically across the network. The completion of the 
Keystone-XL pipeline from Canada through the COTH and down to Nederland, Texas 
will improve the resiliency of the network and reduce the risk associated with a Black 
Swan event. Further analysis should be conducted to explore alternative and additional 
pipelines to accomplish this effort. Also, by increasing safety across the network by the 
individual pipeline operators, security of the infrastructure will be enhanced. By focusing 
resources on the identified critical areas, the network as a whole will become more 
resilient to disruption by a terrorist attack, natural disaster, or other catastrophic events. 
The results of this analysis should be used as a starting point to increase network 
resiliency and prioritize the use of resources to secure the crude oil pipeline network 
against cascade failure and a Black Swan event. 
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